iptables FORWARD rules not working on bridge - Request

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware
Goto page 1, 2  Next
Author Message
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Fri Feb 06, 2015 20:51    Post subject: iptables FORWARD rules not working on bridge - Request Reply with quote
Someone please tell me what I am doing wrong.
I have vlan1 with ports 1-5 and vlan2 with just the wan.

Wan is disabled..
Static ip on the lan with default gateway to the public ip on my modem.

This works and packets are being routed from my internal public or private nets to the modem and out.

I have public ips..

On the older routers this is the start of my firewall file and the default is to block all FORWARD so if I don't add specific rules to open ports everything is blocked.


#!/bin/sh
echo "bringing up firewall at "
date
echo " "

IPTABLES="/usr/sbin/iptables"
BT_PORT=6060

echo "clearing tables"
$IPTABLES -t mangle -F
$IPTABLES -t mangle -X
$IPTABLES -t nat -F
$IPTABLES -t nat -X
$IPTABLES -F
$IPTABLES -X

# Set default policies for the INPUT, FORWARD and OUTPUT chains.
# These defaults clamp off all communication to or across the
# bridge box (we will add rules to allow some stuff through
# further down, after we bring up the bridge interface)

echo "setting defaults"
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD DROP
$IPTABLES -t mangle -P PREROUTING ACCEPT
$IPTABLES -t mangle -P OUTPUT ACCEPT
$IPTABLES -t mangle -P INPUT ACCEPT
$IPTABLES -t mangle -P FORWARD ACCEPT


If I run the above on my older boxes ie wrt610n wrt54gs etc.. all outside traffic is blocked as the default forward rule is drop.. Ok so good.. I add additional rules with -A to open up ports machines etc.

If I run the same script on the newer boxes and f/w netgear r6300v2 or r7000 nothing is blocked.

It is as if the forward rules are not working at all.

Amyone have suggestions please?


Last edited by lgkahn on Tue Feb 10, 2015 18:18; edited 2 times in total
Sponsor
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Fri Feb 06, 2015 20:58    Post subject: Reply with quote
could it be the newer builds require and additional library/module.. here are the ones I am loading:

echo 'modules'
/sbin/insmod /lib/modules/3.10.65/ebtables
/sbin/insmod /lib/modules/3.10.65/ebtable_broute
/sbin/insmod /lib/modules/3.10.65/ebtable_filter
/sbin/insmod /lib/modules/3.10.65/ebtable_nat
/sbin/insmod /lib/modules/3.10.65/ebt_ip
/sbin/insmod /lib/modules/3.10.65/ebt_snat
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5695
Location: Akershus, Norway

PostPosted: Sat Feb 07, 2015 10:39    Post subject: Reply with quote
The rules will not be applied when wan is disabled.
If your Modem is connected to a lan port, it will just be a switch and not route.
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Sat Feb 07, 2015 14:18    Post subject: Reply with quote
Take a look at my previous post.. this is what I am trying to do.. and for this the wan is disabled.. it has worked on previous routers..

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=16091&postdays=0&postorder=asc&start=0


It is not really routing it is a transparent bridge.. with iptable rules at the level 2 bridge.

I think the patch to the kernel that used to be there to allow this is missing:

see

http://osdir.com/ml/linux.network.bridge/2002-05/msg00077.html
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Sat Feb 07, 2015 14:23    Post subject: Reply with quote
I am now trying to go back a few generations of routers to see if I can find one where it still works.
the last I had it on was a wrt610n but it is too slow with the firewall to keep up with my new 100mbit connection.. most I can get after turning off unused services and having the minimum firewall rules I need is 80meg
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Tue Feb 10, 2015 16:26    Post subject: Reply with quote
is there anyone that can confirm that the kernel patch is missing for necessary for the iptables to look at the bridge?
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5695
Location: Akershus, Norway

PostPosted: Tue Feb 10, 2015 16:52    Post subject: Reply with quote
You have to use ebtables that work at the mac level. iptables is for routing.
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Tue Feb 10, 2015 16:56    Post subject: Reply with quote
I already loaded ebtables but the forward firewall rules are doing nothing.. see this post ..

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=278685
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Tue Feb 10, 2015 16:58    Post subject: Reply with quote
actually that is what the kernel patch does.. allows use of iptables at the the level 2 packets..


see this

http://osdir.com/ml/linux.network.bridge/2002-05/msg00077.html
Per Yngve Berg
DD-WRT Guru


Joined: 13 Aug 2013
Posts: 5695
Location: Akershus, Norway

PostPosted: Tue Feb 10, 2015 17:06    Post subject: Reply with quote
http://ebtables.netfilter.org/examples/basic.html#all
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Tue Feb 10, 2015 17:11    Post subject: Reply with quote
yes I know that is not useful to really do a firewall. as you don't know the mac etc of incoming traffic.. That is why the kernel patch that allows iptables to work at level 2 was very useful. It used to be in previous builds.. IT works on my wrt610n with version 12774

I would be willing to donate again if we can get the patch I mentioned in my posted built into the kernel.

I believe the patch is called
bridge-nf
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Tue Feb 10, 2015 17:14    Post subject: Reply with quote
for now I am try to go back versions of routers to find one with more horsepower than the wrt610n where iptables does work on the level 2 bridge.

I am going to try a wrt400n tonigt an keep my fingers crossed.. I will also try an e4200
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Tue Feb 10, 2015 17:22    Post subject: Reply with quote
these versions seem to be missing this is the file for the version I used on the wrt610n.. anyone know where I can find the comparable build with same kernel for the wrt400n

dd-wrt.v24-12774_big-wrt610n.bin

the kernel seems to be 2.4.37
found more about what I need


Configuring Ethernet Bridging

You'll remember from the previous two installments that in order to support iptables in bridging mode, your Linux kernel needs to be compiled with CONFIG_BRIDGE_NETFILTER=1, and your /etc/sysctl.conf file either needs to not contain any entries for the following settings or have them set to “1”:
net.bridge.bridge-nf-call-arptables=0
net.bridge.bridge-nf-call-ip6tables=0
net.bridge.bridge-nf-call-iptables=0


can anyone recompile/build one of the newer netgear r6300v2 or netgear r7000 branches with these options for me.. Pretty please... thanks

here is the article were I got this info from

http://www.linuxjournal.com/article/10929
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Fri Feb 13, 2015 15:35    Post subject: Reply with quote
no one?
lgkahn
DD-WRT User


Joined: 01 May 2007
Posts: 276

PostPosted: Sat Mar 07, 2015 21:09    Post subject: Reply with quote
for anyone interested the kong build 22000++ for the e4200 has the kernel compiled with netfilter enabled and the iptables firewall does work on the bridge..

the version I am running is

DD-WRT v24-sp2 (06/07/14) kingkong - build 22000M

the kernel in this version is

Linux 2.6.24.111 #620 Sat Jun 7 21:57:31 CEST 2014 mips


now if only I could find a version that works on the r6300v2 the kong version I tried does not have that kernel option as the firewall is not working on the bridge..
At lesst now I can get about 91 megabit with the e4200 with the firewall enabled.. 110 mbit without it..
Goto page 1, 2  Next Display posts from previous:    Page 1 of 2
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> Broadcom SoC based Hardware All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum